Jupyter Notebook up to 5.7.0 nbconvert Response handlers.py cross site scripting

Summaryinfo

A vulnerability was found in Jupyter Notebook up to 5.7.0. It has been classified as problematic. This issue affects some unknown processing of the file notebook/nbconvert/handlers.py of the component nbconvert Response Handler. Performing a manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2018-19351. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Jupyter Notebook up to 5.7.0. This affects an unknown code block of the file notebook/nbconvert/handlers.py of the component nbconvert Response Handler. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

The bug was discovered 11/18/2018. The weakness was shared 11/18/2018 (Website). It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2018-19351 since 11/18/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 120736 (Fedora 28 : python-notebook (2018-b9581d9624)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l.

Upgrading to version 5.7.1 eliminates this vulnerability. A possible mitigation has been published 4 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (120736). The entry VDB-127000 is related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Jupyter

Name

• Notebook

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7.0

License

• open-source

Website

• Product: https://github.com/jupyter/notebook/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion